IBM Security Bulletin: Vulnerabilities in MD5 Signature and Hash Algorithm and TLS 1.2 affects sendmail, imap, and pop3d on AIX (CVE-2015-7575, CVE-2016-0266)

TLS 1.2 is not the default communication for sendmail, imap, and pop3d, and TLS 1.2 is impacted by the MD5 Sloth vulnerability.

CVE(s): CVE-2015-7575, CVE-2016-0266

Affected product(s) and affected version(s):

        AIX 5.3, 6.1, 7.1, 7.2
        VIOS 2.2.x

        The following fileset levels are vulnerable:
        
        key_fileset = aix

        Fileset                 Lower Level  Upper Level KEY 
        ---------------------------------------------------------
        bos.net.tcp.client      5.3.12.0     5.3.12.10   key_w_fs
        bos.net.tcp.server      5.3.12.0     5.3.12.6    key_w_fs
        bos.net.tcp.client      6.1.9.0      6.1.9.102   key_w_fs
        bos.net.tcp.server      6.1.9.0      6.1.9.101   key_w_fs
        bos.net.tcp.client      7.1.3.0      7.1.3.47    key_w_fs
        bos.net.tcp.server      7.1.3.0      7.1.3.47    key_w_fs
        bos.net.tcp.client      7.1.4.0      7.1.4.1     key_w_fs
        bos.net.tcp.server      7.1.4.0      7.1.4.1     key_w_fs
        bos.net.tcp.imapd       7.2.0.0      7.2.0.0     key_w_fs
        bos.net.tcp.pop3d       7.2.0.0      7.2.0.0     key_w_fs
        bos.net.tcp.sendmail    7.2.0.0      7.2.0.0     key_w_fs
        
        Note:  to find out whether the affected filesets are installed 
        on your systems, refer to the lslpp command found in AIX user's guide.

        Example:  lslpp -L | grep -i bos.net.tcp.client

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2anhsst
X-Force Database: http://ift.tt/1TnIyR8
X-Force Database: http://ift.tt/2axFyWO

from IBM Product Security Incident Response Team http://ift.tt/2b5NjPw